Pwn2Own Miami 2022 was a fine competition. At the contest, I successfully exploited three different targets. In this blog post, I would like to show you my personal best research of the competition: the custom deserialization issue in Inductive Automation Ignition.
There are several things that make this vulnerability interesting, including the following:
· It exists in a custom deserialization routine, which seems to derive some inspiration from the Java XMLDecoder.
· It allows you to gain Remote Code Execution on two hosts at the same time: the client where the malicious project file is initially loaded, as well as the server that ultimately handles the file.
· There is a nice platform that can help an attacker deliver the malicious file to potential victims.
· In addition to the vector that involves a victim opening a malicious file locally on a client, it can also be exploited through a purely remote vector, in two different ways: either via an API call or via the Project Import functionality in the admin panel.
Since the remote vector requires an authentication bypass, at Pwn2Own, I decided to keep it simple and stick with the local vector.
This vulnerability was discovered through static code analysis. My full write-up for the contest was 50 pages long. Here I will try my best to provide you with as much information as possible, while not producing a blog post of excessive length. First, here’s a quick video of the exploit in action, showing RCE on both the client and the server! I popped calc.exe on the client, whereas cmd.exe /c whoami > C:\poc.txt was executed on the server.
Introduction to Ignition Projects
According to the Ignition manual, projects are one of the two main components of this platform, the other component being Ignition Gateway. Projects allow you to specify views, data operations, reports and so forth. Moreover, an official .
When you have a valid API cookie, you can load a malicious project with the following HTTP request:
Conclusion
Inductive Automation Ignition is a powerful product that provides great deal of functionality for ICS engineers. One must remember, though, that a rich feature set can also mean a large attack surface. In this blog post, I have shown you the custom deserialization implementation used by Ignition when processing project files. The wide flexibility it offers opens the door to misuse.
I hope you liked this post. If you ever see names of Java classes in an unknown data structure, I encourage you to dig deeper. There is a chance that you will find something interesting there! Until my next post, you can follow me or Instagram for the latest in exploit techniques and security patches.
SOCIAL SHARE CARD GENERATOR